This is one of the many potential applications of the new "-privileged" flag of Docker. This is very exciting, because it means that we will soon run Docker CI within Docker itself (instead of ad-hoc VMs), among other things!
The big thing for me about the privileged flag is the ability to run VPN software on the containers-- this way, they can talk to each other cross-physical-machine as well as between containers on the same host.
We're on the same page. That's my next hack — an OpenVPN server within Docker. The blog post, Dockerfile, and helper scripts should be out next week :-)
My system uses peer to peer software to synchronize each container's public keys and IP address/port information, as well as a mesh network VPN. This allows me to easily join a new node to the VPN cluster (using ENV variables to specify the port and public address to listen on, which is then used in the Docker container creation) and still have minimal latency between any two nodes.
I'll probably have to write up a post myself describing the system and how Docker is used to create new containers and add it to the cluster.
OpenVPN is only client-server, so I'm currently using tinc[1]. BitTorrent Sync is the software used to synchronize the actual public keys and container IP addresses.
Cgroups and namespaces. Even though some namespaces are nested (typically, the PID namespace) why others don't need to be.
There is nothing special with nesting cgroups and namespaces from the kernel point of view. The interesting part is to work around the little details (as anybody who ran nested LXC containers will know) :-)
Comments
This is one of the many potential applications of the new "-privileged" flag of Docker. This is very exciting, because it means that we will soon run Docker CI within Docker itself (instead of ad-hoc VMs), among other things!
The big thing for me about the privileged flag is the ability to run VPN software on the containers-- this way, they can talk to each other cross-physical-machine as well as between containers on the same host.
We're on the same page. That's my next hack — an OpenVPN server within Docker. The blog post, Dockerfile, and helper scripts should be out next week :-)
Great, looking forward to seeing it.
My system uses peer to peer software to synchronize each container's public keys and IP address/port information, as well as a mesh network VPN. This allows me to easily join a new node to the VPN cluster (using ENV variables to specify the port and public address to listen on, which is then used in the Docker container creation) and still have minimal latency between any two nodes.
I'll probably have to write up a post myself describing the system and how Docker is used to create new containers and add it to the cluster.
Whoa. That's really cool. What do you use that for?
Also: does openVPN drive your "mesh network VPN"? i thought it was only client<-->server!
OpenVPN is only client-server, so I'm currently using tinc[1]. BitTorrent Sync is the software used to synchronize the actual public keys and container IP addresses.
[1]: http://www.tinc-vpn.org/
To be fair this is a standard feature of Linux Control Groups that's existed for years now. For more info on how that works, see https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt
Cgroups and namespaces. Even though some namespaces are nested (typically, the PID namespace) why others don't need to be.
There is nothing special with nesting cgroups and namespaces from the kernel point of view. The interesting part is to work around the little details (as anybody who ran nested LXC containers will know) :-)